Managing API Keys
API keys are the credentials that authorize your agents to call the Guardrail API. This guide covers generating, rotating, and revoking keys safely.
Generating a New Key
- 1
Navigate to your dashboard and click API Keys in the left sidebar.
- 2
Click "Generate New Key" in the top right corner.
- 3
Your full API key will appear ONCE in a yellow banner. Copy it immediately to a password manager or secrets vault.
- 4
The key will never be shown again. We store only its SHA-256 hash for authentication.
Key Limits
Revoking a Key
Click the trash icon next to any key. A confirmation modal will appear — click "Yes, Revoke Key" to permanently delete it. Revocation is instant and irreversible. Any service using that key will immediately receive HTTP 401 Unauthorized on the next request.
Key Rotation Best Practices
Rotate every 90 days
Generate a new key, update all your services, then revoke the old key. Never leave old keys active after rotation.
One key per service / agent
Use separate keys for your production chatbot, staging environment, CI/CD pipeline, and local development.
Rotate immediately after a suspected breach
If you suspect a key has been exposed (in logs, Git, a screenshot), revoke it instantly and generate a replacement.
Use environment variables, never code
Store keys as environment variables or in a secrets manager like Doppler, Vault, or AWS Secrets Manager.